Ansible role

[devopsserver1 ansible]$ mkdir roles [devopsserver1 ansible]$ pwd /home/devops/ansible [devopsserver1 ansible]$ vim ansible.cfg将当前目录ansible配置文件中的角色读取路径改为当前目录[devopsserver1 ansible]$ ansible-galaxy role list # /home/devops/ansible/roles[devopsserver1 ansible]$ cd roles/ [devopsserver1 roles]$ ansible-galaxy role init apache - Role apache was created successfully [devopsserver1 roles]$ ansible-galaxy role list # /usr/share/ansible/roles # /etc/ansible/roles [WARNING]: - the configured path /home/devops/.ansible/roles does not exist.警告只是因为~/.ansible/roles目录不存在Ansible 无法从中读取角色[devopsserver1 roles]$ cd apache/ [devopsserver1 apache]$ tree . . ├── defaults │ └── main.yml ├── files ├── handlers │ └── main.yml ├── meta │ └── main.yml ├── README.md ├── tasks │ └── main.yml ├── templates ├── tests │ ├── inventory │ └── test.yml └── vars └── main.yml目录/文件作用defaults/main.yml角色的默认变量优先级最低可被覆盖files/存放需要复制到远程主机的静态文件如配置文件、脚本handlers/main.yml定义触发器如重启服务在任务中通过notify调用meta/main.yml角色元数据作者、依赖关系、支持的平台等tasks/main.yml核心任务列表角色执行时从这里开始templates/存放 Jinja2 模板文件可动态渲染变量tests/测试角色用的 inventory 和 test.ymlvars/main.yml角色的高级变量优先级高不易被覆盖playbook[devopsserver1 apache]$ cd tasks/ [devopsserver1 tasks]$ ls main.yml [devopsserver1 tasks]$ vim main.ymlhandlers[devopsserver1 tasks]$ cd .. [devopsserver1 apache]$ cd handlers/ [devopsserver1 handlers]$ vim main.yml--- # handlers file for apache - name: restart service httpd ansible.builtin.service: name: httpd state: restarted模板[devopsserver1 apache]$ cd templates/ [devopsserver1 templates]$ cp /home/devops/ansible/httpd.conf.j2 . [devopsserver1 templates]$ ls httpd.conf.j2变量[devopsserver1 apache]$ cd vars [devopsserver1 vars]$ ls main.yml [devopsserver1 vars]$ vim main.yml--- # vars file for apache http_port: 80[devopsserver1 ansible]$ vim apacher_role.yml--- - hosts: webservers roles: - role: apache直接运行会显示密码加密先将别的变量文件移走在单独运行apache[devopsserver1 ansible]$ mv host_vars/ groups_vars/ /tmp/防火墙1. 关闭防火墙[devopsserver1 ansible]$ vim apacher_role.yml--- - hosts: webservers roles: - role: apache #http_port: 8080 tasks: - name: disable the firewalld ansible.builtin.service: name: firewalld state: stopped enabled: no post_tasks: - name: Check that you can connect to a page ansible.builtin.uri: url: http://192.168.150.153 return_content: true register: result - name: print return information from the previous task ansible.builtin.debug: var: result.content2.开启[devopsserver1 ansible]$ ansible-galaxy collection install ansible.posixpre_tasks: - name: enable the firewalld ansible.builtin.service: name: firewalld state: started enabled: yes设置防火墙规则tasks: - name: configure the firewalld ansible.builtin.firewalld: service: http # 要开放的服务名称 state: enabled # 启用该服务允许流量通过 permanent: true # 规则持久化重启防火墙后仍然生效 immediate: true # 立即生效无需重启防火墙安装提供selinux角色的包[devopsserver1 ansible]$ sudo yum install -y rhel-system-roles.noarch配置文件要加入全局的路径[devopsserver1 ansible]$ vim ansible.cfg时间同步[devopsserver1 ~]$ cd /usr/share/doc/rhel-system-roles/ [devopsserver1 rhel-system-roles]$ cd timesync/ [devopsserver1 timesync]$ cp example-single-pool-playbook.yml /home/devops/ansible/ [devopsserver1 timesync]$ cd /home/devops/ansible/ [devopsserver1 ansible]$ mv example-single-pool-playbook.yml timesync.yml编辑时间同步[devopsserver1 ansible]$ vim timesync.yml --- - name: system timesync hosts: webservers vars: timesync_ntp_servers: - hostname: ntp1.aliyun.com pool: true iburst: true roles: - rhel-system-roles.timesync进行主机的时间同步[devopsserver1 ansible]$ ansible-playbook timesync.yml导入playbook在apacher_role.yml中导入playbook同时实现时间同步[devopsserver1 ansible]$ vim apacher_role.yml - name: timesync playbook import_playbook: timesync.yml[devopsserver1 ansible]$ cd /usr/share/doc/rhel-system-roles/ [devopsserver1 rhel-system-roles]$ cd selinux/ [devopsserver1 selinux]$ cp example-selinux-playbook.yml /home/devops/ansible/ [devopsserver1 selinux]$ cd /home/devops/ansible/ [devopsserver1 ansible]$ mv example-selinux-playbook.yml selinux.yml[devopsserver1 ansible]$ vim apacher_role.yml --- - hosts: server3 #修改主机 ······· - name: selinux playbook import_playbook: selinux.yml #导入selinux的playbook编辑selinux的playbook[devopsserver1 ansible]$ vim selinux.yml --- - name: Manage SELinux policy example hosts: server3 vars: # Use targeted SELinux policy type selinux_policy: targeted # Set enforcing mode selinux_state: enforcing # # Switch some SELinux booleans # selinux_booleans: # # Set the samba_enable_home_dirs boolean to on in the current # # session only # - name: samba_enable_home_dirs # state: true # # Set the ssh_sysadm_login boolean to on permanently # - name: ssh_sysadm_login # state: true # persistent: true # # Map /tmp/test_dir and its subdirectories to the user_home_dir_t # # SELinux file type selinux_fcontexts: - target: /www(/.*)? setype: httpd_sys_content_t ftype: d state: present # Restore SELinux file contexts in /tmp/test_dir selinux_restore_dirs: - /www # Map tcp port 22100 to the ssh_port_t SELinux port type selinux_ports: - ports: 82 proto: tcp setype: http_port_t state: present # # Map the sar-user Linux user to the staff_u SELinux user # selinux_logins: # - login: sar-user # seuser: staff_u # serange: s0-s0:c0.c1023 # state: present # # Manage modules # selinux_modules: # # Install the localpolicy.cil with priority 300 # - path: localpolicy.cil # priority: 300 # state: enabled # # Disable the unconfineduser module with priority 100 # - name: unconfineduser # priority: 100 # state: disabled # # Remove the temporarypolicy module with priority 400 # - name: temporarypolicy # priority: 400 # state: absent tasks: - name: Creates directory file: path: /www state: directory mode: 0755 - name: Execute the role and reboot in a rescue block block: - name: Include selinux role include_role: name: rhel-system-roles.selinux rescue: - name: - Fail if failed for a different reason than selinux_reboot_required fail: msg: role failed when: not selinux_reboot_required - name: Restart managed host reboot: - name: Wait for managed host to come back wait_for_connection: delay: 10 timeout: 300 - name: Reapply the role include_role: name: rhel-system-roles.selinux由于未设置防火墙对82的规则所以会报错测试没报错因为是设置的本机访问本机所以成功[devopsserver1 ansible]$ vim test_url.yml --- - hosts: localhost become: false gather_facts: false tasks: - name: Check that you can connect to a page ansible.builtin.uri: url: http://192.168.150.154:82 return_content: true register: result - name: print return information from the previous task ansible.builtin.debug: var: result.content[devopsserver1 ansible]$ vim apacher_role.yml --- - hosts: server3 roles: - role: apache http_port: 82 pre_tasks: - name: enable the firewalld ansible.builtin.service: name: firewalld state: started enabled: yes tasks: - name: configure the firewalld ansible.builtin.firewalld: service: http state: enabled permanent: true immediate: true - name: Open custom port {{ http_port }}/tcp in firewall ansible.builtin.firewalld: port: 82/tcp state: enabled permanent: true immediate: true # post_tasks: # - name: Check that you can connect to a page # ansible.builtin.uri: # url: http://server3:82 # return_content: true # register: result # # - name: print return information from the previous task # ansible.builtin.debug: # var: result.content - name: test_url playbook import_playbook: test_url.yml - name: selinux playbook import_playbook: selinux.yml关掉80端口加入https将http_port定义为 Play 变量从Ansible Galaxy官方角色仓库下载并安装由 Jeff Geerling 维护的Nginx 角色到你的本地系统用的2.14版本官方维护的不支持[devopsserver1 ansible]$ ansible-galaxy role install nginxinc.nginx [devopsserver1 ansible]$ ansible-galaxy role install geerlingguy.nginx把server2上不用的服务先关掉[rootserver2 ~]# systemctl disable --now zabbix-server.service Removed /etc/systemd/system/multi-user.target.wants/zabbix-server.service. [rootserver2 ~]# systemctl disable --now httpd.service Removed /etc/systemd/system/multi-user.target.wants/httpd.service. [rootserver2 ~]# systemctl disable --now php-fpm.service Removed /etc/systemd/system/multi-user.target.wants/php-fpm.service. [rootserver2 ~]# systemctl disable --now mysqld.service Removed /etc/systemd/system/multi-user.target.wants/mysqld.service. [rootserver2 ~]# systemctl disable --now zabbix-agent.service Removed /etc/systemd/system/multi-user.target.wants/zabbix-agent.service.将路径加入全局变量中[devopsserver1 ansible]$ vim ansible.cfgvim nginx.yml --- - hosts: server2 roles: - role: geerlingguy.nginx[devopsserver1 ansible]$ ansible-playbook nginx.ymlcd /home/devops/.ansible/roles/geerlingguy.nginx/defaults vim main.yml部署redis[devopsserver1 ~]$ ansible-galaxy role install geerlingguy.redis[devopsserver1 ansible]$ vim nginx.yml --- - hosts: server2 roles: - role: geerlingguy.nginx - role: geerlingguy.redis[devopsserver1 ansible]$ ansible-playbook nginx.yml